Firstov attacking mongo db

Attacking MongoDB

Firstov Mihail

What is it?

MongoDB — is an open source document-oriented database system.

Features :

1. Ad hoc queries.

2. Indexing

3. Replication

4. Load balancing

5. File storage

6. Aggregation

7. Server-side JavaScript execution

8. Capped collections

Inside mongo source code

C

C++

Java

Javascript

.NET (C# F#, PowerShell, etc)

Node.js

Perl

PHP

Python

Ruby

Scala

There are a lot of drivers for different

program languages:

./mongo – official client in C++ and JS

./mongod — Server in C++

http://www.mongodb.org/display/DOCS/C+Language+Center

http://www.mongodb.org/pages/viewpage.action?pageId=133409

http://www.mongodb.org/display/DOCS/Java+Language+Center

http://www.mongodb.org/display/DOCS/Javascript+Language+Center

http://www.mongodb.org/display/DOCS/CSharp+Language+Center

http://www.mongodb.org/display/DOCS/node.JS

http://www.mongodb.org/display/DOCS/Perl+Language+Center

http://www.mongodb.org/display/DOCS/PHP+Language+Center

http://www.mongodb.org/display/DOCS/Python+Language+Center

http://www.mongodb.org/display/DOCS/Ruby+Language+Center

http://www.mongodb.org/display/DOCS/Scala+Language+Center

Who use mongoDB

List of some big companies that use mongoDB:

1. SAP

2. SourceForge (hosting for open source projects)

3. The New York Times

4. GitHub (social coding project)

5. Foursquare

6. Yandex

A RESTful web service (also called a RESTful web

API) is a web service implemented using HTTP and

the principles of REST. It is a collection of

resources, with four defined aspects

WTF is RESTful?

How I can discover it?

Default port is «28017».

If server was started without “—rest”, you can see this:

How I can discover it?

What kind of vulns are there?

Execution of arbitrary code server JS

Stored XSS in mongoDB log

Stored XSS in queries journal

Cross Site Request Forgery

Our SSJS code

Attack

MongoDB

--REST

Hacker

Site with

mongoDB

driver support

Admin’s browser

1) Send “<script>” with our javascript code

Hacker’s

Server

Attack

MongoDB

--REST

Hacker

Site with

mongoDB

driver support

Admin’s browser


Hacker’s

Server

2) Inject our script in

REST interface

Attack

MongoDB

--REST

Hacker

Site with

mongoDB

driver support

Admin’s browser


Hacker’s

Server


REST interface

3) Exec our js-code in

admin’s browser

Attack

MongoDB

--REST

Hacker

Site with

mongoDB

driver support

Admin’s browser


Hacker’s

Server

4) Send

SSJS

command to

our script


REST interface


admin’s browser

Attack

MongoDB

--REST

Hacker

Site with

mongoDB

driver support

Admin’s browser


Hacker’s

Server

4) Send

SSJS

command to

our script

5) Wait until admin’s browser check

our server for the new commands

(via JSONP)


REST interface


admin’s browser

Attack

MongoDB

--REST

Hacker

Site with

mongoDB

driver support

Admin’s browser


Hacker’s

Server

4) Send

SSJS

command to

our script



(via JSONP)


REST interface


admin’s browser

6) Our command gets executed

Attack

MongoDB

--REST

Hacker

Site with

mongoDB

driver support

Admin’s browser


Hacker’s

Server

4) Send

SSJS

command to

our script



(via JSONP)

7) Send answer to our sniffer


REST interface


admin’s browser


Attack

MongoDB

--REST

Hacker

Site with

mongoDB

driver support

Admin’s browser


Hacker’s

Server

4) Send

SSJS

command to

our script

8) Print result

of executed

command



(via JSONP)

7) Send answer to our sniffer


REST interface


admin’s browser


Where we can find it?

Stable CRASH

There are a lot of concepts of DoS attacks:

Interesting features

Ls, cat and other admin functions work only with mongoDb console client.

NativeHelper function helps you with system commands:

You can get data in text/plain by reading db-files of mongoDB with any text editor.

Network interaction

Adding user:

Source Code:

Decrypted salt:

Network interaction

Captured packets:

All your data are belong to us:

Network interaction

Algorithm for sniff and brute force password :

Sniff some packets

with mongoDB data

Look for auth

packet

Exit

Not found

Get key, nonce, login

from this packet

found

key2 = md5(nonce + user +

md5(user + ":mongo:" + passw)),

where “passw” is string from dict

Read string

from

dictionary

key == key2

false

print user:passwd

true

Сетевое взаимодействие

Network interaction. MiTM attack

admin

mongoDB

Hacker

1. Authorization

query


admin

mongoDB

Hacker

1. Authorization

query

2. Return special nonce

using which rainbow

tables were generated


admin

mongoDB

Hacker

1. Authorization

query


using which rainbow


3. Client sends to us

“key” and “login”


admin

mongoDB

Hacker

1. Authorization

query


using which rainbow




4. Brute Force

password using pre-

generated rainbow

tables for this nonce


admin

mongoDB

Hacker

1. Authorization

query


using which rainbow




4. Brute Force

password using pre-

generated rainbow

tables for this nonce

5. Successfully login

WTF is BSON?

What is it?

BSON is a computer data

interchange format used mainly as

a data storage and network

transfer format in the MongoDB

database. The name "BSON" is

based on the term JSON and

stands for "Binary JSON".

Example?

Data types:

string

int

double

DateTime

byte[]

bool

null

BsonObject

BsonObject[]

Overwriting variables

Some table with 2 documents:

Our query to database:

Injecting BSON document, and overwriting “isadmin” value:

Testing:

Reading memory

Exploit:

In action:

Length

Reading memory

In action:

Features of some programming languages

Ruby on Rails

nodejs

PHP


Ruby on Rails


Mass assignment in Ruby on Rails:


NodeJS


JSON injection в NodeJS + MongoDB:

VULNERABLE SOURCE CODE:

RESULT QUERY:

SEND

Хакер 02/12 (157)

http://habrahabr.ru/company/xakep/blog/143909/


PHP


Types of vulnerabilities:

Bypass authorization via Array in php driver.

Injecting SSJS code.

Blind SSJS injecting, Time-based


As you know, php processes data from GPC as Array:

There is find() function in the official driver for php:

password[$ne]=parol1


And we got this query to mongoDB collection:

With these techniques you can bypass authorization:


Injecting in SSJS.

For example, we have this vulnerable code:

/

We can see our login, id and pass in answer

Trying to inject in SSJS query:

As you can see, we rewrite “login” value by db.version() value

$q = “function() { var loginn = ‘$login’; var passs = ‘$pass’; db.members.insert({id : 2,

login : loginn, pass : passs}); }”;

$db->execute($q);


Sometimes we can’t see answer from our SSJS code.

For this situations we can use Time-Based technique:

A special script was written for this task.

NoSQL-injection Cheat Sheet

db.getName() – Get current DB name

db.members.count() – Get number of documents in the collection

db.members.validate({ full : true}) – Get ALL information about this collection

db.members.stats() – Get information about this collection

db.members.remove() – remove all documents from current collection

db.members.find().skip(0).limit(1) – Get documents from DB (Change only number in skip() function)

db.getMongo().getDBNames().toString() – Get the list of all DBs

db.members.find()[0][‘pass’] – Get “pass” value from current collection

Thanks!

Firstov Mikhail

[email protected]

Firstov attacking mongo db

Documents

Transcript of Firstov attacking mongo db